The document summarizes recent malware outbreaks and cyber attacks targeting the state government. It notes that in February and March, several malware outbreaks infected over 1,000 end-user computers within the state network. These were contained but cost over $500,000. In March, a hacking group called Vikingdom launched DDoS attacks that briefly took down the state website and vowed further attacks. The state took measures like IP address changes and network separation to limit the impacts. The document also provides statistics on ongoing intrusion attempts and infected devices within the state network. It outlines the challenges in protecting state data from increasingly sophisticated cyber criminals, hacktivists, foreign governments, and terrorist groups.

1. OIR Security Update
Prepared for: Customer Focused Government
April 20th, 2015

2. Increasing Malware Outbreaks
• February 6th – Virus infected approximately 600 end-user computers within 15
minutes (a total of 793 computers)
• February 13th - Second affects 50 end-user computers
• February 19th - A third outbreak affects 123 end-user computers
• Two of three outbreaks were initiated by state employees accessing personal
email from a state computer (Yahoo and Hotmail)
• Outbreak contained with no state entrusted data lost, but response and
containment costs estimated in excess of $500,000
• March 26th – OIR Security enforces Existing Security Policy prohibiting access to
personal email from state network by blocking employee access to major email
sites
2

3. State Targeted in Denial of Service (DDoS Attacks)
• March 25th – Hacking Group “Vikingdom” attacks Tennessee taking TN.Gov
offline for a brief period can causing network latency
• Notice sent to IT staff… Channel 4 news calls within 10 minutes. News 4 runs
story on March 26th despite requests
• March 27th – Vikingdom quotes News 4 story in Tweet, vows to bring Tennessee
state web sites down
• March 31st – Second Vikingdom DDoS attack, State security staff switch
TN.GOV IP addresses and separates TN.GOV from State user network limiting
impacts
• March 4th – Vikingdom launches major attack with over 8 Gigabytes of traffic,
impacting citizen access to TN.GOV intermittently
• March 13th – OIR signs contract with AT&T to provide upstream DDoS
protection services
3

4. 4
Intrusion Attempts:
• 234M blocked each month
(92.5M in September 2014, >250% increase)
External Email Gateway:
• 2.5M rated as malicious or SPAM and dropped each month
• 9M processed in and out of the State each month
Internet Content Filtering:
• 4.29B connections each month
• 11.55M connections blocked each month
o 33% blocked for security reasons
o 67% blocked for administrative categories
Infected Devices:
• 120 workstations/laptops each month
Cyber Security Facts and Figures

5. Our Adversaries Are Highly Motivated
• Cyber Criminals – Fraud and theft
(Hackers average income - $800K per year!)
• Hacktivists – Politically/cause-motivated
(Anonymous, Vikingdom, etc.)
• Governments – Cyber warfare and industrial espionage
(The US Military considers Cyber Warfare the number one threat to
the security of the United States)
• Terrorist Organizations – The newest emerging threat
(Cyber Caliphate, etc.)
5

6. Challenges in Protecting State Data
• End user device management (consistent patching, hardening, appropriate
user privileges & access)
• Targeting of mobile devices
• “Internet of things” (4.9B devices today, 25B by 2020)
• Ever increasing sophistication of adversaries:
o Targeted attacks
o Ransomware
o Drive by downloads
o Social engineering
• Staff behavior remains the #1 security risk across all sectors
• State must continue a holistic approach of leveraging advanced security
technology, audit and penetration testing, user training, and appropriate
controls
6

7. When it comes to cyber-security, we
have to win every single battle…
the bad guys only have to win once.